summaryrefslogtreecommitdiffstats
path: root/block/blk-flush.c
diff options
context:
space:
mode:
authorMing Lei <ming.lei@redhat.com>2020-11-13 21:44:48 +0800
committerJens Axboe <axboe@kernel.dk>2020-11-13 14:24:16 -0700
commit9f16a66733c90b5f33f624b0b0e36a345b0aaf93 (patch)
tree227d28d4d7eeb88c4bc882c185a014eeab67c9ee /block/blk-flush.c
parentc01a21b77722db0474bbcc4eafc8c4e0d8fed6d8 (diff)
downloadlinux-9f16a66733c90b5f33f624b0b0e36a345b0aaf93.tar.gz
linux-9f16a66733c90b5f33f624b0b0e36a345b0aaf93.tar.bz2
linux-9f16a66733c90b5f33f624b0b0e36a345b0aaf93.zip
block: mark flush request as IDLE when it is really finished
For avoiding use-after-free on flush request, we call its .end_io() from both timeout code path and __blk_mq_end_request(). When flush request's ref doesn't drop to zero, it is still used, we can't mark it as IDLE, so fix it by marking IDLE when its refcount drops to zero really. Fixes: 65ff5cd04551 ("blk-mq: mark flush request as IDLE in flush_end_io()") Signed-off-by: Ming Lei <ming.lei@redhat.com> Cc: Yi Zhang <yi.zhang@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block/blk-flush.c')
-rw-r--r--block/blk-flush.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/block/blk-flush.c b/block/blk-flush.c
index e32958f0b687..fd5cee9f1a3b 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -225,13 +225,18 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error)
/* release the tag's ownership to the req cloned from */
spin_lock_irqsave(&fq->mq_flush_lock, flags);
- WRITE_ONCE(flush_rq->state, MQ_RQ_IDLE);
if (!refcount_dec_and_test(&flush_rq->ref)) {
fq->rq_status = error;
spin_unlock_irqrestore(&fq->mq_flush_lock, flags);
return;
}
+ /*
+ * Flush request has to be marked as IDLE when it is really ended
+ * because its .end_io() is called from timeout code path too for
+ * avoiding use-after-free.
+ */
+ WRITE_ONCE(flush_rq->state, MQ_RQ_IDLE);
if (fq->rq_status != BLK_STS_OK)
error = fq->rq_status;